Christian Köberl

OWASP Spotlight - Project 41 - OWASP Cornucopia v2.0 m.youtube.com/watch?v=4sL8... What if threat modelling did not feel like a long meeting filled with diagrams, unfamiliar terminology, and one security person doing all the talking? #cornucopia #appsec #security #ai #games

"The people holding up the internet" A good-looking but somewhat depressing exposé about the people holding up current digital infrastructure as a hobby. https://sheets.works/data-viz/holding-up-the-internet

A random guy telling the world how to install some new software. An illustration.

Very nice talk from 39c3 (Chaos Communication Congress): media.ccc.de/v/39c3-hacki... @jeffgeerling.com - guess you can use this to add your dishwasher to home connect

Made a site comparing the sizes of living things :) The great Julius Csotonyi spent 5 months painting over 60 illustrations for the site, no ai used > neal.fun/size-of-life/

This is really great - worked on all the pages I've checked so far

Why just talk to your AI agent when you can interact with it? Now you can, with MCP-UI. Live in goose 1.3.0 Learn more: block.github.io/goose/blog/2...

I built a ridiculous 1000 pixel display that takes an hour to draw an image and I'm now asking the internet to draw on it (what could go wrong?) Please submit some 40×25 pixel art at kilopx.com!

I just wanted to say, I’m probably more proud of this Ted talk than just about anything I’ve ever done so I’m gonna be absolutely useless for the next couple of weeks as I promote the shit out of this because I want you to watch it because it matters in the moment we are in youtu.be/dVG8W-0p6vg

I made a quiz about the JS Date parser is. It's very easy and you will score very high. jsdate.wtf

In my latest video over on @syntax.fm I showcase the 9 new features added to the JavaScript language in this years spec. Watch 🍿: www.youtube.com/watch?v=1-cj...

If you use "AI agents" (LLMs calling tools in a loop) you need to be aware of the Lethal Trifecta Combine access to private data, exposure to untrusted content and the ability to externally communicate and an attacker can trick the system into stealing your data simonwillison.net/2025/Jun/16/...

presented without comment

Here's video, slides and a detailed annotated transcript from my talk at this week's AI Engineer World's Fair conference in San Francisco - "The last year six months in LLMs, illustrated by pelicans on bicycles" simonwillison.net/2025/Jun/6/s...

"our team may crumble due to pronunciation of the word 'GIF'" this new episode of Web Dev Challenge is ABSOLUTE CHAOS (complementary) watch it here: codetv.link/wdc/s2e3

Great post if you want to understand sampling in monitoring/logging

The folks behind the “State of …” surveys have a new one, and there are zero questions about coding! Instead, the focus is on us. ✨ The questions are about developer interests, health, work preferences, stuff like that. I’m *super* keen to see the results! You can take the survey here:

OpenAI just dropped GPT-4.1 & a new Codex CLI. The first State of Web Dev AI survey is in: winning tools, what devs are spending, and what’s a pain. Plus: @nextjs.org 15.3 lands, and "slopsquatting" enters the dev lexicon. 🧠⚡️ You don’t want to miss this. Show link: front-end-fire.com/episodes/91/

@scott.hanselman.com do you have any guidance for configuring MS Defender for Endpoint on Windows dev machines? We have CPU usage of 10-30% when doing nothing and "Antimalware Service Executable" takes 75% cpu while compiling. We tried excluding folders and DevDrive - nothing seems to work.

Referencing xkcd.com/327/

My notes on the GPT-4.1 series so far - 1m tokens (across all three models) and GPT-4.1-nano being their cheapest model yet are particularly notable simonwillison.net/2025/Apr/14/...

After 5 years in the making, I'm very happy to finally release Anime.js v4, my dream animation library: 🧩 New modular API ⚡️ Highly performant 🖱️ Scroll-linked animations 🫵 Draggables ↔️ Responsive ✨ Additive animations 🪽 WAAPI support And so much more! Check out the new website animejs.com!

I see a lot of folks asking if specific MCPs exist. Fortunately, there's a few directories where you can search for whatever you want. I call them my MCP Toy Stores lol. Here are my go-tos: dev.to/techgirl1908...

Doom now runs in @typescriptlang.org types. What a journey this one's been.

Check out my second channel on YouTube! Every week you'll get fresh front-end/fullstack news with me and my friends TJ and Paige! It's really fun, and it's informative too!

After JS Party podcast was shut down 😭 I found my new favorite web development podcast 🎉 @front-end-fire.com front-end-fire.com - really recommend subscribing in your favorite podcast player!

Great episode, great podcast! Bluesky shows that a small team with motivated experts can achieve anything. Thx @jaz.bsky.social for the humble talk about the amazing things that they achieve.

I'm going to business hell for this one

Encoding any text in invisible unicode - this might be useful 😀󠅟󠅢󠄐󠅙󠅤󠄐󠅓󠅟󠅥󠅜󠅔󠄐󠅒󠅕󠄐󠅘󠅑󠅢󠅝󠅖󠅥󠅜 paulbutler.org/2025/smuggli...

Must reads for web developers - how modern browsers work: 1️⃣ bit.ly/browsers-pt1 2️⃣ bit.ly/browsers-pt2 3️⃣ bit.ly/browsers-pt3 4️⃣ bit.ly/browsers-pt4 and browser.engineering a free to read book on the topic

My talk from this year's We Love Speed is on YouTube! 👇 In "Tight Mode: how browsers REALLY load web pages", I take a very deep/very nerdy dive into why browsers sometimes intentionally delay loading resources, why they all do it differently, and why they should *stop clowning around* 🤡 #webperf

I built a tiny JS library providing async alternatives to the alert() and confirm() and prompt() simonwillison.net/2024/Dec/7/p... await Prompts.alert("alert message"); const confirmedBoolean = await Prompts.confirm("Proceed?"); const name = await Prompts.prompt("Enter your name");

absolutely incredible attack vector

First impressions of the new Amazon Nova LLMs (via a new llm-bedrock plugin) simonwillison.net/2024/Dec/4/a... The vibes are good with these ones - they're price and performance competitive with the Google Gemini family, which means they are _really_ inexpensive

Alas

Insightful frontend survey from Software House tsh.io/state-of-fro... State of the Frontend 2024. I had the honor of writing up the summary of the component libraries section. Really interesting results!

I made a Chrome Extension to bring Bluesky comments to any URL :) Get it here: github.com/joneslloyd/b... Credits to: - @emilyliu.me - @coryzue.com - @louee.bsky.social Any feedback and/or PRs are welcome. I threw this together in 1.5 errors, so expect bugs etc.

GenAIScript is pretty awesome - you can easily create small scripts with a sprinkle of AI. In a few minutes I've written a custom GitLab bot that summarizes and reviews all merge requests. Nice! microsoft.github.io/genaiscript/

Exploring the full bluesky firehose, in three dimensions: firehose3d.theo.io

Post a picture you took (no description) to bring some zen to the timeline

This is one of the best (and most painful) blogs I've ever read. Thank you @develwithoutacause.dwac.dev for writing it 🫡 blog.dwac.dev/posts/html-w...

🦋